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I.  INTRODUCTION 


All  submarines  require  a  self-contained  life  support  system  to  allow 
prolonged  submerged  operations.  Present  submarine  operating  procedures  employ 
either  electrolysis  or  chlorate  candles  to  generate  oxygen.  A  potential 
alternative  to  these  conventional  systems  is  the  cryogenic  storage  of  liquid 
oxygen  (LOX),  which  at  atmospheric  pressure  and  normal  ambient  temperatures 
evolves  at  a  rate  comparable  to  that  required  for  life  support  on  a  submarine. 

With  no  moving  parts,  compact  storage  of  the  liquid  form  and  worldwide 
availability,  a  LOX  system  poses  as  a  simple  and  efficient  alternative.  Much 
experience  with  small  LOX  systems  exists  with  aircraft,  where  all  high  altitude 
fighters  and  transports  are  so  equipped.  The  simplicity,  light  weight,  and 
minimum  volume  have  proven  effective. 

Further,  a  LOX  system  actually  used  underwater  to  provide  breathing  oxygen 
was  developed  by  Airco  Cryogenics  of  Irvine,  CA  under  contract  N00014-67-C-0095 
S4607  for  the  Office  of  Naval  Research.1  The  system  was  tested  in  1967  60  feet 
under  water  in  Sea  Lab  I  -  STEP  at  the  United  States  Navy  Mine  Defense  Laboratory 
(USN  MDL)  at  Panama  City,  FL.  That  part  of  the  system  which  supplied  breathing 
oxygen  operated  successfully  and  it  was  concluded  that  for  future  operations 
involving  relatively  short-term  storage  (less  than  five  months),  liquid  oxygen 
should  be  seriously  considered.  Particularly  in  view  of  the  1  arjje  scal e  — 

commercial  distribution  system  of  oxygen,  it  is  felt  that  cryogenic  storage  of 
the  product  would  be  practical  for  many  land-based,  shipboard,  and  submerged 
appl ications. 
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However,  liquid  oxygen  (LOX)  with  a  boiling  point  of  -183*C  poses  potential 
hazards  which  must  be  considered  prior  to  engineering  development;  the  hazards 
inclnde  those  associated  with 

(1)  the  intrinsic  properties  of  liquid  and  gaseons  oxygen,  and 

(2)  the  changes  in  the  properties  of  materials  subjected  to  the 
'  low  temperature  environment. 

The  purpose  of  this  reported  research  has  been  twofold: 

(1)  Review  from  first  principles  the  properties  of  liquid  and  gaseous 
oxygen  in  a  submarine  environment,  and 

(2)  apply  these  principles  to  a  candidate  shipboard  design. 


In  the  storage  and  transfer  of  LOX,  the  safety  objectives  are  to  get  the 
fluid  to  the  use  or  storage  point  in  a  pure  state,  to  effect  any  disposal  in  a 
safe  manner,  and  to  prevent  any  damage  to  the  system.  Since  oxygen  exists  as  a 
liquid  only  at  temperatures  considerably  below  ambient,  normal  storage  must 
account  for  an  unavoidable,  inexhaustible  heat  input  available  from  the 
environment.  If  the  heat  input  to  LOX  is  excessive,  vaporization  may  occur  with 
explosive  rapidity.  The  same  condition  may  result  if  the  LOX  is  allowed  to 
become  superheated.  Superheated  liquid  nitrogen  has  caused  dewars  to  explode. 
Many  materials,  particularly  hydrocarbons,  may  ignite  or  explode  under 
conditions  of  mechanical  shock  in  the  presence  of  liquid  or  dense  gaseous 
oxygen.  Gaseous  oxygen,  or  GOX  in  missile  vernacular,  is  generally  regarded  as 
being  more  dangerous  to  handle  than  the  liquid. 
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It  has  been  observed  that  all  explosions  In  LOX  systems  actually  take  place 
in  the  gaseous  phase  because: 

(a)  The  rapid  "boil-off"  rate  of  LOX  fonts  an  oxygen-rich  ataiosphere 
above  the  surface  of  the  liquid. 

(b)  Combustible  materials  do  not  always  react  spontaneously  in  LOX. 
but  will  either  burn  or  explode  if  ignited  in  the  gaseous  oxygen 
atmosphere  above  the  liquid. 

(c)  Few  reactions  take  place  at  the  temperature  of  LOX. 

(d)  Gaseous  oxygen  reacts  more  readily  with  metals  than  any  other 
element  except  fluorine. 

The  primary  hazards  of  interest  in  dealing  with  LOX  are  those  associated 
with  the  response  of  the  human  body  to  the  fluid  and  its  vapors,  and  those 
associated  with  reactions  between  the  fluid  and  its  surroundings.  The  first 
includes  frostbite,  respiratory  ailments,  and  chemical  burns;  the  second,  phase 
changes,  low- temperature  effects,  ignition,  and  other  hazards.  To  these  hazards 
which  are  always  associated  with  handling  LOX,  another  exists  when  LOX  is  used 
for  supplying  breathing  oxygen,  namely  the  physiological  effects  of  too  much  or 
too  little  oxygen. 

No  effort  is  made  in  this  report  to  examine  the  complex  question  of 
material  compatibility.  An  extensive  body  of  literature  exists  on  this  subject 
which  must  be  consulted  when  hardware  design  is  begun.  Also  not  considered  are 
cleanliness  and  contamination  standards.  Existing  military  standards  (NIL  STD) 
are  presumed  appropriate  and  sufficient.  Because  this  analysis  was  intended  to 
be  an  independent  and  early  look  at  potential  safety  problems,  little 
interaction  has  taken  place  between  this  contractor  and  the  system  designers  or 
their  safety  experts  beyond  the  acquisition  of  general  system  configuration  and 
operating  parameters.  For  this  reason,  many  of  the  concerns  raised  in  this 
report  may  already  have  been  addressed.  Further,  due  to  the  limited  scope  of 
this  study,  those  areas  of  safety  which  represent  standard  engineering  practice 
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have  been  discussed  only  in  a  general  way.  Lastly,  becanse  of  the  system 
symmetry,  detailed  analysis  of  the  candidate  system  is  carried  out  only  for  a 
single  storage  tank  of  a  multi-tank  design. 
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II.  GENERIC  ACCIDENT  REVIEW 


An  analysis  was  conducted  of  206  accidents  involving  liquid  oxygen.1  The 
results  of  this  analysis  are  shown  in  figure  1.  The  total  nuatber  of  citations 
is  237  because  some  accidents  were  the  result  of  multiple  causes. 

The  largest  single  cause  of  accidents  was  system  contamination  by 
hydrocarbons.  In  many  cases  where  contamination  was  not  the  primary  accident 
cause,  it  was  a  contributing  factor.  The  classical  fuel  in  oxygen  system 
explosions  has  been  acetylene,  which  is  very  sparingly  soluble  and  which  has 
precipitated  from  solution  where  evaporation  of  liquid  oxygen  was  taking  place. 

The  next  two  categories,  operator  error  and  poor  maintenance,  are  amenable 
to  reduction  through  "foolproof "  design,  comprehensive  and  continuing  training, 
and  a  genuine  commitment  to  safety. 

The  large  number  of  cases  in  the  "unknown"  category  reflects  the  often 
catastrophic  nature  of  a  LOX  accident  in  which  most  of  the  evidence  is 
destroyed. 

One  potential  problem  area  which  turns  out  to  be  a  rather  minor  concern  is 
personnel  injury  due  to  contact  with  LOX.  Because  LOX  in  contact  with  a  warm 
surface  is  subject  to  film  boiling,  heat  transfer  is  relatively  poor.  A  major 
international  producer  and  handler  of  cryogenic  fluids  with  over  30  years 
experience  states  "our  personnel  injury  incidence  from  'cold  burns'  has  been 
practically  nil.*" 
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In  the  sane  study  the  following  factors  were  found  to  be  of 
primary  importance  in  causing  system  failures  in  LOX  facilities: 


•  Mechanical  failure  of  the  containment  vessel,  piping,  or  auxiliary 
components  due  to  brittle  failure  or  freeze-up. 

e  Reaction  of  the  LOX  with  the  confining  vessel  or  auxiliary  equipment. 

e  Reaction  of  the  LOX  with  a  contaminant. 

e  Failure  of  a  safety  device  to  operate  properly. 

e  Operator  error. 
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III.  SYSTEM  DESCRIPTION 


A  candidate  liquid  oxygen  storage  and  supply  system  is  shown  in  figures  2 
and  3.  Figure  2  shows  that  part  of  the  system  external  to  the  pressure  hull  of 
the  submarine.  This  includes  all  cryogenic  parts  as  well  as  the  fill  and  vent 
piping,  vapor  removal  piping,  rupture  disks,  and  emergency  vapor  vent. 

Provision  is  made  for  transferring  LOX  from  one  tank  to  another  as  well  as  the 
emergency  dumping  of  both  liquid  and  vapor.  The  system  is  designed  to  be 
multiply  redundant  with  similar  piping  configurations  for  all  tanks.  Each  tank 
has  a  design  volume  of  70  ft*  providing  about  2500  man-days  of  gaseous  oxygen 
per  tank  assuming  a  10%  ullage  when  full. 

A  10%  vapor  space  has  been  generally  accepted  as  a  standard  condition, 
because  it  is  difficult  to  fill  a  norma]  dewar  to  greater  than  90%  of  its  volume 
with  rapid  filling  rates.  At  the  end  of  most  filling  operations,  inadequate 
cool-down  of  the  dewar  mass  and  a  shallow  de-entrainment  space  above  the  liquid 
will  cause  liquid  to  be  carried  into  the  vent  piping.  This  indicates  a  full 
vessel,  and  at  this  point  the  vessel  will  be  approximately  90%  full. 

Figure  3  shows  the  system  internal  to  the  pressure  hull.  The  symmetry  of 
the  piping  system  allows  vapor  to  be  withdrawn  from  any  tank  and  supplied  to  the 
submarine  distribution  system  by  any  of  several  paths. 

As  designed,  each  tank  would  be  filled  separately.  Using  tank  1  as  an 
example,  the  supply  line  would  be  connected  at  A,  CV-13  and  CV-11  would  be 
opened  while  CV-12  and  V-14  would  be  closed.  LOX  would  be  pumped  until  TC-11 
indicated  liquid  in  the  vapor  withdrawal  line  or  the  difference  between  PT-11 
and  PT-12  indicated  the  tank  was  full. 
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{Annulus  control  system  is  not  shown). 


Pressure  hull 


Figure  3,  Oxygen  flow  control  eyetem  (echematlc). 


At  this  time  CV-13  would  be  closed  and  the  supply  line  vented  and 
disconnected.  When  TC— 11  indicated  that  the  vapor  withdrawal  line  was  free  of 
liquid,  CV-11  would  be  closed  and  V-14  could  be  opened  admitting  GOX  to  the 
distribution  system. 

When  vaporization  of  LOX  due  to  thermal  in-leak  is  insufficient  to  provide 
the  required  flow  rate,  electrical  heaters  are  provided  on  each  tank  to  increase 
the  vaporization  rate  as  needed.  Under  normal  operation,  the  entire  system  will 
be  just  sufficiently  above  atmospheric  pressure  to  allow  for  pressure  drops  in 
piping,  and  other  system  components  while  providing  for  acceptable  GOX  flows. 

The  principal  differences  between  this  system  and  those  which  have  been 
used  routinely  for  many  years  are: 

e  All  components  of  the  system  external  to  the  pressure  hull  (including 
all  cryogenic  parts)  must  be  designed  to  withstand  sea  water  at  the 
pressures  encountered  by  the  submarine. 

e  The  system  must  be  designed  to  withstand  internal  pressures  sufficient 
to  allow  vapor  venting  or  LOX  dumping  against  the  outside  pressure 
encountered  at  depth. 

e  The  LOX  is  not  subcooled  but  is  maintained  at  its  boiling  point. 

It  will  be  seen  that  the  first  two  requirements  present  severe  constraints  on 
the  system  design. 

Because  of  the  requirement  to  be  able  to  dump  LOX  while  submerged,  the 
inner  vessel  of  the  LOX  storage  tank  must  withstand  a  pressure  greater  than  that 
of  the  surrounding  sea  water  in  order  to  provide  the  pressure  differential 
necessary  for  dumping.  Again  using  tank  1  as  an  example,  the  high  pressure 
requirement  extends  at  least  to  V-14  and  for  safety,  probably  should  extend 
throughout  the  system. 
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IV.  DESIGN  SAFETY  CONSIDERATIONS 


IV-1.  Pressure  Vessel 


Pressure  vessels  for  storing  cryogenic  fluids  including  LOX  are  usually 
designed  in  accordance  with  the  American  Society  of  Mechanical  Engineers  (ASME) 
Code,  Section  VIII,  Division  1;  Code  for  Unfired  Pressure  Vessels.  It  should  be 
noted,  however,  that  the  ASME  code  does  not  encompass  baffle  or  internal  piping 
designs,  nor  does  it  provide  cleanliness  specifications  for  oxygen  service.  The 
principal  thrust  of  the  code  is  the  mechanical  design  of  the  pressure  vessel 
shell  and  fittings. 

Safe  design  requires  the  elimination  of  all  pockets,  crevices,  or  cavities 
in  which  accumulation  of  foreign  matter  could  occur;  all  channels  in  which  the 
reaction  of  foreign  materials  and  oxygen  could  magnify  the  damage,  and  any 
piping  in  wnich  the  concentration  of  impurities  or  contaminants  usually  found  in 
LOX  could  occur. 

The  low  temperature  of  LOX  can  have  a  profound  affect  on  the  properties  of 
the  solid  materials  used  in  the  containing  system.  The  strength  of  materials  is 
usually  not  a  safety  problem  at  LOX  temperatures  since  strength  increases  as  the 
temperature  decreases.  However,  it  is  advisable  to  use  room  temperature 
strengths  in  the  design  of  equipment  for  several  reasons. 

First,  most  proof  testing  is  done  at  ambient  temperatures;  second,  the 
equipment  may  warm  up  under  stress;  third,  because  of  temperature  gradients,  not 
all  of  the  system  will  always  be  at  the  system's  lowest  temperature. 

The  usual  practice  in  cryogenic  design  calls  for  an  inner  vessel  as  thin  as 
practical  since  a  thick-walled  vessel  requires  a  longer  time  to  cool  down. 
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wastes  more  fluid  in  cooldown,  and  introduces  the  possibility  of  thermal 
stresses  in  the  vessel  wall  during  cooldown. 

Thermal  stresses  can  arise  during  the  cooldown  of  a  system  as  well  as 
during  steady  state  operation.  The  physical  properties  which  influence  the 
magnitude  of  these  stresses  in  a  given  material  are  the  coefficient  of  thermal 
expansion,  the  thermal  conductivity,  and  the  elastic  modulus. 

In  well  insulated  systems  at  operating  temperature  usually  the  only 
significant  stress  problems  result  from  the  axial  thermal  contraction  of  the 
cooled  line.  During  cooldown,  radial  and  circumferential  stresses  can  also 
occur.  Stresses  due  to  transient  gradients  can  be  minimized  by  proper  operating 
procedures. 

Circumferential  temperature  gradients  can  result  during  the  cooldown 
process  from  stratified  flow  in  horizontal  pipes  which  permits  the  bottom  of  the 
pipe  to  cool  faster  than  the  top.  The  differential  thermal  contraction  will 
then  cause  the  pipe  to  bow  and  the  resulting  stresses  will  depend  upon  the  shape 
of  the  temperature  gradient  and  the  manner  in  which  the  pipe  is  restrained. 

Because  of  the  underwater  venting  requirement,  the  inner  vessel  of  the 
storage  tan*  must  be  designed  to  withstand  full  external  ambient  pressure. 
Operational  restrictions  will  probably  have  to  be  put  on  filling  rates  to 
prevent  severe  thermal  stresses  in  the  wall.  Long  cooldown  times  are  also 
anticipated.  Thick  walls  on  inner  tanks  are  not  unprecedented.  Very  large  LOX 
storage  tanxs  (900,000  gallons)  have  walls  nearly  1.5"  thick  near  the  bottom  to 
withstand  the  weight  of  the  liquid. 

The  thermal  capacity  of  most  solid  materials  at  low  temperatures  is  very 
small  because  of  the  decrease  in  specific  heat  as  the  temperature  decreases. 

For  this  reason,  the  solid  material  in  a  system  is  not  effective  in  retarding  a 
rapid  temperature  rise  for  a  given  heat  input.  In  general  the  largest  thermal 
capacity  of  a  LOX  system  resides  in  the  LOX  itself. 
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IV-2.  Contamination  Control 

As  shown  in  Section  II,  the  most  frequent  cause  of  LOX  accidents 
is  a  chemical  reaction  between  the  LOX  and  contamination  in  the  system. 

For  LOX  systems  where  contamination  can  be  hazardous,  it  is  necessary  to 
remove  undesirable  gases  from  the  system  by  purging.  For  portions  of  the  system 
with  large  length  to  diameter  ratios  (L/D  >>1)  a  flow-through  purge  is  usually 
most  effective.  This  portion  of  the  system  must  be  equipped  with  suitable  purge- 
gas  introduction  and  vent  ports,  a  purge-gas  supply  system,  and  gas  sample 
ports.  A  gas  analysis  capability  should  also  be  available.  For  components 
with  small  length  to  diameter  ratios  or  in  which  the  entire  volume  cannot  be 
swept  with  purge  gas,  purging  is  effected  by  either  evacuation  and  backfill  to  1 
atm  or  pressurization  to  a  few  atmospheres  followed  by  venting  to  1  atm.  The 
previous  steps  or  combinations  thereof  are  repeated  as  required  to  obtain  the 
desired  purity.  One  should  not  rely  upon  computations  or  experience  to 
determine  the  extent  of  purge  effected.  The  inevitable  existence  of  dead-ends, 
adsorbed  gas,  and  incomplete  mixing  makes  purging  less  than  100%  effective  even 
for  simple  systems.  For  this  reason  gas  analysis  is  required  for  verification 
of  purge  adequacy.  Also  gas  samples  should  be  taken  from  locations  where 
purging  is  least  likely  to  be  complete.  Gas  analysis  is  usually  accomplished  by 
means  of  a  mass  spectrometer  or  a  gas  chromatograph. 

As  an  additional  precaution  in  the  long-term  storage  of  LOX,  periodic  warm¬ 
up  (defrost)  and  analysis  of  the  dewar  contents  is  desirable.  Each  wara-up 
should  bring  the  coldest  spot  in  the  dewar  to  a  high  enough  temperature  that  the 
most  likely  impurity  is  above  its  normal  boiling  point. 

A  purge  system  has  been  considered4  which  would  tie  into  the  proposed 
system  at  P-15  (see  Figure  3).  Any  purge  system  should  incorporate  a  check 
valve  to  keep  oxygen  out  of  the  purge  system  unless  the  purge  gas  is  oxygen. 

A  back-up  GOX  system,  connected  to  the  system  at  the  purge  point,  V-15, 
might  be  a  reasonable  precaution.  The  GOX  could  also  be  used  as  the  purge  gas 
as  is  standard  on  aircraft.* 
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As  the  heavier  hydrocarbons  are  only  slightly  soluble  in  LOX,  it  is  most 
unlikely  that  dangerous  concentrations  ot  these  materials  will  be  present. 
However,  in  a  system  subjected  to  normal  storage  and  handling  procedures, 
frozen,  solid  hydrocarbon  particles  can  flake  off  and  move  with  the  liquid.  If 
this  debris  lodges  in  a  valve,  a  fire  or  explosion  may  result  due  to  impact 
forces  generated  by  opening  and  closing  the  component.  It  is  also  important  to 
monitor  for  00^  because  of  possible  clogging  of  components  due  to  the  presence 
of  dry  ice.  Slight  changes  of  tank  temperature  or  pressure  can  cause 
precipitation  oi  CO^  in  any  LOX  system  in  which  the  concentration  has  been 
observed  to  be  at  or  above  its  saturation  point. 

Since  LOX  is  continually  boiling  in  the  storage  tanks,  the  composition  of 
the  fluid  is  continually  changing,  with  00  and  nonvolatile  materials 
concentrating  and  settling  out  in  direct  proportion  to  the  evaporation  rate. 
These  contaminants  will  generally  accumulate  in  the  quiescent  regions  of  a  tank 
or  system  and  are  seldom  uniformly  distributed.  Moreover,  data  accumulated  at 
several  government  research  centers  show  that  CO^  is  present  in  all  oxygen 
loading  systems  in  excess  of  its  saturation  point;  hence,  in  a  solid  state.* 
Because  the  density  of  CO^  is  greater  than  that  of  LOX,  it  sinks  to  the  bottom 
of  the  tank  and  has  actually  been  removed  by  hand  shoveling.  Even  though  00^ 
particles  can  clog  a  filter,  the  individual  particles  tend  to  migrate  through, 
whatever  their  initial  size,  and  no  known  LOX  filter  will  hold  back  all  of  the 
00^  once  it  is  in  the  system. 

When  impurities  exceed  their  solubility  and  come  out  of  solution,  forming 
islands  of  solid  within  or  on  the  surface  of  liquid  oxygen,  it  is  evident  that 
localized  flammable  mixtures  can  occur  even  though  the  average  concentration 
throughout  the  system  may  be  far  below  the  flammable  range.  Normal  liquid 
sampling  and  analysis  techniques  (useful  in  safeguarding  against  more  soluble 
hydrocarbons)  are  not  capable  of  detecting  the  approach  of  insolubles  to 
hazardous  concentrations. 

A  special  hazard  exists  in  the  proposed  design  because  of  the  use  of 
hydraulic  valves  in  the  LOX  piping.  Contamination  of  the  LOX  by  hydraulic  fluid 
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must  be  absolutely  prevented.  In  addition,  the  LOX  must  be  thermally  separated 
from  the  hydraulic  fluid  to  prevent  freeze  np  from  interfering  with  valve 
actuation. 


IV-3.  Leakage 

It  is  frequently  difficnlt  to  prevent  all  leakage  paths  in  a  large  and 
complicated  system.  For  this  reason,  such  systems  are  usually  maintained  at  a 
pressure  above  ambient  (usually  1  atmosphere  air)  so  that  if  leakage  occurs  it 
will  be  out-leakage  which  is  usually  tolerable. 

Any  leakage  into  a  cryogenic  system  can  cause  line  blockage  as  a  result  of 

frozen  vapor  from  H  0  or  gases.  Such  frozen  particles  in  a  system  can  also  be 
2 

troublesome  by  causing  valve  seat  erosion  or  by  accumulating  undesirable 
impurities.  Such  solid  impurities  do  not  necessarily  leave  the  system  with  the 
LOX  and  thus  can  accumulate  over  a  period  of  time.  For  this  reason  as  well  as 
the  large  liquid  to  vapor  density  ratio  which  proportionally  increases  any 
undesirable  property  of  the  LOX,  such  fluids  have  been  referred  to  as  risk 
concentrators.  However,  the  degree  ot  risk  is  usually  less  than  that  involved 
in  the  use  of  an  equal  quantity  of  high  pressure  gas.  The  surroundings  of  all 
LOX  equipment  including  lines  and  valves  must  be  scrutinized  for  possible 
hazards  in  case  of  LOX  leakage  out  of  the  system. 

Leakage  in  the  proposed  system  could  have  particularly  unfortunate 
results.  Vhile  the  submarine  is  submerged,  any  leakage  of  the  system  outside 
the  pressure  hull  (which  includes  all  cryogenic  components)  will  be  leakage  of 
sea  water  into  the  system.  Possible  results  of  this  in-leakage  will  be 
discussed  in  Section  VII.  A  possible  means  of  circumventing  this  problem  would 
be  to  maintain  the  system  at  high  pressure  and  provide  pressure  reduction  inside 
the  pressure  hull.  This  would  require  only  minor  redesign  since  the  system  must 
be  capable  of  withstanding  high  pressure  to  allow  for  underwater  venting.  The 
hazards  associated  with  high  pressure  LOX  storage  would  have  to  be  carefully 
considered. 
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IV- 4 .  Overpressure  and  Venting 

All  isolatable  spaces  which  can  hold  LOX  must  be  provided  with  some  method 
to  accommodate  at  safe  pressure  the  maximum  gas  evolution  rate  that  could 
occur.  (This  usually  occurs  upon  the  complete  loss  of  insulating  vacuum.) 

When  more  than  one  valve  is  used  in  a  given  section  of  piping,  a  suitable 
pressure  relieving  device  must  be  used  in  each  section  of  piping  between  valves 
to  protect  the  pipe  from  rupture  in  the  event  that  both  valves  are  closed  with 
liquid  in  the  pipe.  Check  valves  can  sometimes  be  used  instead  of  manually 
operated  valves,  in  which  case  the  relieving  device  may  be  unnecessary. 

The  vacuum  snell  of  cryogenic  vessels  should  be  equipped  with  a 
pressure-relief  device  to  prevent  overpressurization  in  the  event  of  a  leak  from 
the  inner  shell  into  the  vacuum  space.  If  the  relief  device  is  a  rupture  disk, 
the  disk  should  be  supported  with  a  vacuum  backing  disk.  This  will  prevent 
collapse  of  the  rupture  disk  when  the  insulation  space  is  evacuated. 

Vacuum- insulated  lines  should  also  be  provided  with  relief  devices  for  the 
annular  space. 

Rupture  disks  require  time  to  operate  and  may  not  provide  protection  during 
very  rapid  pressure  excursions,  as,  for  instance,  when  a  detonation  occurs. 

The  rupture  disks  must  be  sized  to  handle  either  the  maximum  flow  rate  if 
the  heater  failed  "on,"  the  maximum  fill  rate  if  the  vent  valve  were  left 
closed,  or  the  maximum  gas  evolution  rate  if  all  insulation  were  lost,  whichever 
is  greater. 

Liquid  containers  are  normally  protected  from  overpressure  by  means  of  a 
standard  safety  valve.  In  this  application,  however,  such  a  device  may  be 
subject  to  frost  accumulation  when  in  operation;  and  there  is  the  possibility 
that  it  may  subsequently  freeze  shut.  Furthermore,  the  change  in  temperature 
may  affect  the  valve  spring  constant  and  change  the  relieving  pressure. 
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Because  the  rupture  disks  provide  the  only  protection  for  the  system  from 
over  pressure,  their  design  must  be  carefully  considered.  Accommodation  rnnst  be 
made  for  the  large  reaction  force  which  could  develop  if  a  rupture  disk  bursts. 
Careful  consideration  should  also  be  given  to  the  thermodynamic  situation  which 
exists  if  a  rupture  disk  bursts  to  ensure  that  any  sudden  gas  evolution  due  to 
pressure  release  boiling  can  be  accommodated. 

The  design  of  the  vents  for  the  rupture  disks,  as  well  as  those  for  the 
cryogenic  vapor  vent  and  emergency  cryogen  drain,  present  a  difficult  problem. 
These  must  be  somehow  open  to  the  environment  and  also  provide  personnel 
protection  snould  they  release  while  the  ship  is  on  the  surface. 

Some  means  must  also  be  provided  to  prevent  the  changing  pressure  on  the 
outside  of  the  rupture  disk  from  changing  the  calibrated  burst  pressure  of  the 
device.  A  double  disk  with  the  outside  disk  calibrated  to  a  lower  burst 
pressure  might  be  one  solution. 

Personnel  protection  is  particularly  important  for  the  vapor  vents,  since 
cold  GOX  will  be  issuing  from  these  during  the  filling  operation  while  crewmen 
are  on  deck.  Some  sort  of  vent  extender  may  be  required  for  the  filling 
operation.  An  extender  would  also  allow  the  GOX  to  be  vented  away  from  the  ship 
in  a  secure  location. 

During  an  underwater  venting  or  LOX  dump,  some  provision  must  be  made  to 
keep  the  vents  from  becoming  plugged  with  frozen  sea  water.  It  has  been 
suggested  that  this  could  be  accomplished  by  either  maintaining  a  high  flow  rate 
or  providing  electric  heaters  on  the  vents.4 

Another  method  might  be  double  valves  in  series.  Sea  water  would  keep  the 
outer  valve  waxm  while  the  "dead  space"  between  the  valves  could  be  heated,  if 
necessary. 

Some  sort  of  experimental  program  to  test  the  feasibility  of  underwater 
dumping  of  LOX  will  probably  be  necessary.  It  is  to  be  noted  that  if  the 
rupture  disk  bursts  underwater,  the  entire  system  at  least  up  to  V-14  will  fill 
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with  sea  water.  Even  for  controlled  dumping  or  venting  through  CV-01,  some  sort 
of  check  valve  to  prevent  sea  water  ingress  will  probably  be  necessaryp 
otherwise,  very  close  attention  will  have  to  be  paid  to  pressure  differentials 
between  the  system  and  the  environment.  The  emergency  vapor  vent  almost 
certainly  needs  a  check  valve,  for  without  it,  there  will  be  sea  water  at  full 
pressure  all  the  way  to  V-121,  inside  the  pressure  hull. 

Following  a  tank  to  tank  transfer  of  LOX,  some  liquid  will  inevitably 
remain  in  the  transfer  line.  This  liquid  will  vaporize  leading  to  high 
pressures.  Venting  to  a  selected  tank,  while  possible,  requires  careful  control 
of  the  pressure  d?  ferential  to  prevent  equilibration  followed  by  a  flow  of  LOX 
back  into  the  transfer  line.  This  problem  would  be  obviated  if  the  suggested 
check  valve  were  installed  in  the  emergency  drain  line.  CV-01  could  then  be 
opened  and  the  over  pressure  vented  through  the  emergency  drain  line  until  PT-01 
indicated  a  return  to  safe  pressure. 


Ignition  Hazards 


Most  fuel-oxidant  mixtures  will  not  spontaneously  react  when  placed  in 
contact.  The  activation  energy  for  initiation  of  the  reaction  must  be 
supplied  in  order  for  combustion  to  proceed.  As  an  important  part  of  hazard 
control,  the  forces  which  initiate  combustion  must  be  recognized  and  avoided, 
but  this  should  be  the  second  line  of  defense,  not  a  primary  one.  Modes  of 
ignition  include: 

(a)  Discharge  of  static  electricity  from  suspended  particles  to 
vessel  walls. 

(b)  Shock  waves  in  gases,  liquids,  or  solids. 

(c)  Adiabatic  compression  of  gas  bubbles  in  liquids. 

(d)  Chemical  reactions  leading  to  formation  of  sensitive  chemical 
compounds. 

(e)  Trace  amounts  of  catalytic  or  reaction  promoting  materials. 

(f)  Trace  amounts  of  unstable  materials  which  may  decompose  to 
release  heat. 

(g)  Mechanical  energy  input  through  fluid  flow,  action  of  valves,  or 
devices  which  may  introduce  frictional  heat  or  shock  energy. 

(h)  Energy  input  through  the  kinetic  energy  of  transported  solids. 

(i)  Erosion  of  surfaces  leading  to  accelerated  chemical  reaction. 
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All  equipment  containing  LOX  or  GOX,  including  fill  lines  and  vent  lines, 
should  be  grounded.  In  transfer  operations  grounding  all  equipment  to  a  common 
potential  is  important.  Static  protection  is  not  now  required  when  tank  cars, 
tank  vehicles,  or  marine  equipment  are  loaded  or  unloaded  by  conductive  or 
nonconductive  hose,  flexible  metallic  tubing,  or  pipe  connections  through  or 
from  tight  (top  or  bottom)  outlets  because  no  gap  exists  over  which  a  spark  can 

7 

occur. 

High  humidity  makes  a  contribution  to  safety  in  avoiding  static  sparking  by 

improving  conductivity  in  the  environment;  relative  humidity  over  70t  is 

e 

particularly  effective  in  preventing  buildup  of  static  charges. 

IV-6.  Instrumentation 


A  valuable  and  necessary  adjunct  to  any  transfer  and/or  storage  system  is 
adequate  instrumentation.  The  requirements  include: 

(a)  Pressure  measurements  in  storage  spaces,  insulation  spaces 
(vacuum)  and  in  the  transfer  lines. 

(b)  Temperature  measurements  in  the  storage  space  (to  facilitate 
warm-up  analysis). 

(c)  Liquid  level  measurements  in  storage  dewars. 

(d)  Flow  measurements  on  both  the  liquid  and  purge  systems  (to 
provide  reproducible  purge  flows). 

The  system  as  designed  shows  no  way  to  monitor  flow  through  any  of  the  vent 
lines.  Other  instrumentation  which  might  be  considered  includes  an  oxygen 
monitor  in  the  ballast  hull  for  an  indication  of  leakage  and  a  low  pressure 
alarm  to  indicate  major  system  failure.  An  excess  flow  shutoff  valve  could  help 
ameliorate  the  effects  of  a  major  leak. 
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In  providing  a  system  to  store  and  transfer  large  quantities  of  LOX,  the 
designer  mast  pay  strict  attention  to  fluid  velocities  and  to  the  phenomena 
wnich  occur  at  the  liquid-vapor  interface.  The  dynamic  forces  involved  when 
this  interface  is  disturbed  as  veil  as  vessel  block  valves  and  downstream  piping 
should  be  analyzed  to  determine  if  their  configuration  will  contribute  to  "water 
hammer."  Lines  and  vessels  containing  LOX  should  be  plainly  marked  for  easy 
identification.  Systems  intended  for  military  use  must  not  shatter  when  pierced 
by  gunfire,  and  to  this  end,  they  are  sometimes  bound  with  wire  or  steel 
cables. 
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V.  OPERATIONAL  SAFETY  CONSIDERATIONS 


First  indication  of  a  system  malfunction  is  often  a  high  boil-off  rate  or 
patches  of  external  frost.  Especially  daring  the  filling  operation,  crewmen 
should  be  instructed  to  watch  for  these  signs.  The  filling  hose  should  always 
be  disconnected  immediately  after  the  vessel  is  filled.  Otherwise,  since  some 
liquid  is  trapped  in  the  hose,  it  will  continue  to  evaporate,  and  the  hose  might 
rupture  as  a  result  of  the  pressure  buildup. 

Localized  extremely  high  temperatures  may  be  obtained  through  the  adiabatic 
compression  of  a  gaseous  bubble  confined  within  a  liquid  system.  Hydraulic 
shock  waves  may  result  in  compression  of  the  bubble  for  an  instant  of  time  to 
extremely  high  pressures  and  the  attendant  very  high  adiabatic  compression 
temperatures.  Such  bubble  compression  is  well  known  as  a  source  of  initation  of 
flammable  mixtures  since  the  bubble  and  the  flammable  mixture  immediately 
associated  with  it  may  be  well  above  the  combustion  temperature.  Any 
intentional  pressurization  of  the  cryogenic  portion  of  the  system  must  be  done 
slowly  enough  to  avoid  this  potential  hazard. 

Filling  the  LOX  tanks  must  be  done  very  slowly  for  at  least  two  reasons. 

(11  Because  of  the  unusual  thickness  of  the  inner  vessel,  radial  and 
circumferential  thermal  stresses  can  become  quite  large. 

(2)  As  the  tank  approaches  full,  liquid  will  tend  to  percolate  into 
the  vapor  withdrawal  line  giving  transient  low  temperature 
readings  at  TC-11 . 

When  transferring  liquid  oxygen,  do  not  leave  valves  open  all  the  way;  open 
them  wide  and  then  immediately  close  them  about  one-quarter  turn;  otherwise, 
they  may  freeze  in  the  open  position.9 
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VI.  FAILURE  ANALYSIS 


Except  for  instrumentation,  the  system  would  not  be  seriously  affected  by  a 
loss  ot  electric  power. 

A  failure  of  the  hydraulic  system  would  be  much  more  severe.  Without 
hydraulic  pressure,  there  is  no  way  to  either  dump  or  vent  unless  the  hydraulic 
valves,  e.g.  V-17  and  V-121,  can  be  operated  manually.  Even  with  loss  of 
hydraulics,  the  system  is  still  protected  by  the  rupture  disks.  It  should  be 
noted  tnat  because  the  liquid  is  at  its  saturation  point,  any  reduction  in 
pressure  will  lead  to  a  very  rapid  gas  evolution  as  the  liquid  returns  to 
saturation  at  the  new  pressure.  Any  failure  of  lines  or  tanks  would  involve 
leakage  and  is  discussed  in  Section  VII.  A  Failure  Analysis  Listing  for 
critical  valves  and  vents  is  shown  in  Table  I. 
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Table  1.  Failure  Analysis  Listing  for  Critical  Components  of 

Candidate  LOX  System 


Valve 

Failed  Ooen 

Failed  Closed 

CV-11 

Protected  by  deck  cap 

Unable  to  vent  during 
filling  of  tank  1 

CV-12 

Unable  to  isolate 
tank  1 

Unable  to  dump  LOX  in 
tank  1  or  transfer  tank 

1  contents 

CV-13 

Protected  by  deck  cap 

Unable  to  fill  tank  1 

V-14 

Redundant 

Must  transfer  contents  to 
another  tank  to  utilize 

V-15 

Purge  system  always 
under  pressure 

Must  open  V-16,  26,  and 

25  to  purge 

V-16 

Redundant 

Redundant 

V— 17 

Redundant 

Redundant 

V-18 

Redundant 

Redundant 

V-123 

Must  vent  through 

V-340 

Must  vent  to  bilge 
through  V-343 

V-120 

Redundant 

Must  vent  through  V-340 

V-121 

Redundant 

Must  vent  through  V-341 

CV-01 

If  there  is  no  check 
valve,  water  enters 

LOX  transfer  line  pre¬ 
venting  tank  to  tank 
transfer  and  emergency 
dumping 

Can’t  dump  LOX 

Heater 

_ 

Must  transfer  LOX  to 
another  tank  and  or 
vent  excess  vapor 

LOX  may  be  transferred  to 
another  tank  if  necessary 
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Failure  analysis  indicates  three  situations  of  possible  concern: 


1.  If  CV-12  were  to  fail  closed,  it  would  be  impossible  to  either 
dump  the  contents  of  tank  1  or  transfer  its  contents  to  other 
tanks.  Should  an  emergency  arise,  the  LOX  could  be  vented  as  a 
vapor  through  the  emergency  vapor  vent.  Should  the  gas  evolution 
rate  be  too  great  to  be  accommodated,  the  system  would  still  be 
protected  by  the  tank  1  rupture  disk. 

2.  If  CV-01  failed  open,  sea  water  would  enter  the  LOX  transfer  line 
(in  the  absence  of  a  check  valve).  Subsequent  attempts  at  either 
tank  to  tank  transfers  or  cryogen  dumping  might  cause  the  water  to 
freeze,  plugging  and  perhaps  rupturing  the  line.  Each  individual 
tank  would  stll  be  protected  by  its  own  rupture  disk. 

3.  If  CV-01  failed  closed,  emergency  dumping  of  LOX  would  be 
impossible.  The  system  would  still  be  protected  by  rupture  disk 
RD-01. 
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VII.  LEAKAGE  CONSEQU0JCES 


VII-1.  Pressure  Vessel 

The  consequences  of  an  insulation  vacuum  leak  in  a  LOX  storage  tank  are 
difficult  to  analyze  because  of  the  highly  nonequilibrium  situation  which  would 
exist.  The  worst  case  (and  probably  the  most  likely)  would  be  for  a  leak  to 
develop  while  the  vessel  was  deeply  submerged.  This  would  be  most  likely 
because  the  pressure  differential  would  then  be  greatest.  Two  cases  exist; 
namely : 


(1)  A  leak  through  the  inner  vessel 

(2)  A  leak  through  the  outer  vessel. 

For  an  inner  vessel  leak,  the  insulation  space  would  begin  to  fill  with  LOX 
which  would  quickly  vaporize,  resulting  in  a  large  over  pressure  causing  the 
insulation  space  rupture  disk  to  burst,  followed  by  an  in-rush  of  sea  water. 

For  an  outer  vessel  leak,  the  insulating  space  would  immediately  fill  with 
water.  In  either  case,  as  the  water  cooled  it  would  begin  to  freeze.  Since  the 
thermal  conductivity  of  ice  is  about  20  times  smaller  than  steel,  the  ice  would 
serve  to  insulate  the  inner  vessel.  Note  however  that  ice  is  a  better  heat 
conductor  than  water  by  almost  a  factor  of  5. 

As  ice  cools  from  0°C  to  LOX  temperatures  the  specific  heat  decreases  by  a 
factor  of  S  making  it  less  able  to  retard  temperature  changes.  In  addition,  as 
the  water  freezes,  it  expands  by  about  10%  causing  tremendous  stress  on  both  the 
inner  and  outer  vessels. 

Meanwhile,  the  pressure  in  the  tank  has  been  increasing  due  to  the  thermal 
vaporization  of  the  LOX  and  will  necessitate  transferring  the  remaining  LOX  to 
other  tanks  (if  space  is  available)  or  dumping.  If  the  leak  has  been  in  the 
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inner  vessel,  some  sea  water  may  be  in  the  LOX  tank  bnt  as  ice  (or  water  for 
that  matter)  is  lighter  than  LOX,  it  should  float  and  not  block  the  liquid  drain 
at  the  bottom. 


VII— 2 .  LOX  Fill  Line 


A  leak  of  sea  water  into  the  inner  section  of  the  fill  line  inboard  of  CV- 
13  would  probably  be  detectable  as  an  increase  in  PT-12  due  to  vapor  evolution 
as  the  sea  water  contacted  the  LOX.  This  increase  might  not  be  very  great  for 
two  reasons.  First,  tank  1  would  act  as  a  buffer,  absorbing  some  of  the  excess 
pressure.  Second,  the  water  would  freeze  forming  an  ice  plug  insulating  the  LOX 
to  some  extent  and  blocking  the  entry  of  more  water  unless  the  phase  change 
expansion  caused  the  pipe  to  burst.  Should  this  happen,  the  sequence  would  be 
repeated  until  the  tank  was  reached  at  which  point  the  analysis  proceeds  as  in 
the  case  of  a  pressure  vessel  inner  shell  leak. 

A  leak  of  sea  water  into  the  insulating  space  on  this  line  would  be 
detected  as  a  pressure  increase  on  PT-12.  How  this  could  be  distinguished  from 
the  previous  case  is  not  clear.  How  much  heat  was  transferred  to  tank  1  would 
depend  on  the  piping  geometry.  If  two  phase  flow  could  occur  with  LOX  flowing 
out  to  the  warm  section  on  the  bottom  of  the  pipe  and  returning  along  the  top  as 
vapor,  the  heat  transfer  could  be  relatively  efficient.  If,  however,  the  vapor 
were  trapped,  heat  transfer  would  not  be  nearly  as  great.  A  transfer  or  dump 
could  probably  still  be  effected  in  either  case. 

VII-3.  LOX  Transfer  Line  and  Emergency  Crvoaen  Drain 

Sea  water  leaking  into  the  LOX  transfer  line  would  be  detected  by  a 
pressure  rise  on  PT-01.  Should  personnel  interpret  this  as  trapped  LOX 
vaporizing  and  attempt  to  relieve  the  pressure  by  opening  CV-12,  a  hazardous 
situation  would  exist.  Opening  CV-12  or  any  subsequent  attempt  to  use  the  line 
for  tanz  to  tank  transfer  or  emergency  cryogen  dumping  would  cause  the  water  to 
freeze,  creating  an  ice  plug  which  could  burst  the  pipe. 
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Should  sea  water  leak  into  the  insulation  space  of  this  line,  the  leak 
would  probably  not  be  noticed  unless  and  until  the  line  were  used  for  tank  to 
tank  transfer  or  LuX  dumping.  When  CV-12  was  opened,  the  LOX  would  vaporize 
rapidly,  causing  a  rapid  pressure  rise  at  PT-01 .  Problems  similar  to  those 
encountered  for  a  vacuum  leak  on  a  tank  would  occur,  i.e.  the  water  freezes  in 
the  vacuum  space  and  threatens  to  burst  the  line.  A  transfer  or  dump  might 
still  be  accomplished  if  done  quickly  enough. 

VI1-4.  GOX  Supply  Line 

Sea  water  leaking  into  the  GOX  supply  line  would  flow  into  the  inner  vessel 
of  the  LOX  tank.  This  would  first  be  observed  as  a  rapid  pressure  rise  in  PT— 
11.  The  heat  given  up  as  the  water  froze  in  the  LOX  tank  would  cause  rapid 
evolution  of  vapor.  Since  the  ice  is  lighter  than  LOX,  it  would  float,  perhaps 
making  it  possible  to  transfer  the  LOX  to  another  tank. 

VI1-5 .  Vent  Line 

A  leak  in  this  line  inboard  of  CV-11  would  have  the  same  effect  as  a  leak 
in  the  supply  line  analyzed  in  VII-4. 

VII-6.  Emergency  Vapor  Vent  Line 

Without  a  check  valve,  sea  water  would  already  fill  this  line.  With  a 
check  valve,  sea  water  leaking  in  would  fill  the  line  to  V-121.  This  would  be 
detected  by  a  rapid  pressure  rise  at  PT-120.  Venting  could  be  done  as  usual 
with  the  operational  limitation  that  before  V-121  is  opened,  PT-121  must  read  a 
higher  pressure  than  PT-120. 

VII-7.  Internal  Pining 

A  leak  inside  the  pressure  hull  would  be  a  leak  of  GOX  at  low  pressure  out 
of  the  system.  This  would  be  detected  by  a  pressure  drop  at  P-15  if  the  leak 
were  of  substantial  size.  An  area  oxygen  monitor  might  be  considered  to  provide 
an  early  indication  of  leaks. 


26 


GEO-CENTERS,  INC. 


VIII.  SUMMARY  AND  CONCLUSIONS 


This  research  effort  has  examined  both  the  generic  hazards  of  the  nse  of 
liquid  oxygen  (LOX)  in  a  closed  (submarine)  environment  and  specific  concerns 
relative  to  a  current  candidate  design. 

In  the  generic  analysis,  more  than  200  accidents  involving  LOX  were 
investigated,  and  a  chart  showing  the  distribution  of  identifiable  cases  is 
shown  in  figure  1.  This  analysis  identified  the  four  most  common  causes,  in 
descending  order  of  frequency,  as  follows: 

(1)  Contamination  of  LOX  system  with  hydrocarbons, 

(2)  Operator  error. 

(3j  Improper  maintenance.  v  7 

(4)  Unknown. 

i 

The  large  number  of  cases  in  the  unknown  category  reflects  the  often 
catastrophic  nature  of  a  LOX  accident  in  which  much  of  the  evidence  is 
destroyed. 

A  similar  analysis,  conducted  by  Zabetakis,*  identified  a  similar  array  of 
causes : 

(1)  Mechanical  failure  of  cryogenic  components  due  to  low  temperature 
fatigue  or  component  freeze-up., 

(2)  Reaction  of  LUX  with  the  containment  vessel  or  auxiliary  equip¬ 
ment^ 

(3)  Reaction  of  LOX  with  a  contaminant. 

(4)  Failure  of  safety  devices, 

(5)  Operator  error.  , 
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With  this  background,  a  specific  system  currently  under  consideration  by 
tne  Navy  was  examined  to  identify  possible  areas  of  concern.  Since  this 
critique  was  conducted  independent  of  the  designers,  many  of  these  concerns  may 
already  be  addressed.  Details  of  individual  system  component  analysis  is  given 
in  the  body  of  this  report;  only  the  major  points  are  summarized  here: 

Hydrocarbon  Contamination:  Sources  of  contamination  include:  intrinsic  LOX 
contamination,  filling  procedures,  leakage,  and  hydraulic  fluids  from  valves  and 
pumps.  Suitable  standards  and  procedures  can  minimize  the  rate  of  contamination 
through  handing  channels;  isolation  of  hydraulic  systems  from  LOX  can  eliminate 
this  channex;  periodic  purging  can  eliminate  contaminant  build-up;  and 
instrumentation  can  be  utilized  to  monitor  contamination  level.  This  latter 
point  is  important  since  most  hydrocarbon  contaminants  are  relatively  insoluble 
in  LOX;  they  will  precipitate  out  and  not  be  uniformly  distributed  throughout 
the  system.  Suitable  monitors,  particularly  at  accumulation  points,  e.g. 
valves  and  stagnant  portions  of  the  system,  should  be  installed.  Routine 
sampling  and  purge  procedures  will  likely  be  inadequate,  since  contaminants  are 
prone  to  concentrate  in  stagnant  portions  of  the  system. 

In  addition  to  hydrocarbon  contamination,  the  presence  of  water  (H  0)  and 

2 

carbon  dioxide  (CO^)  represents  an  area  of  concern  since  both  materials  freeze 

and  become  potential  sources  of  blockage,  stress  (due  to  the  thermal  expansion 

of  ice),  pressure  build-up,  and  eventual  rupture.  Many  of  the  hydrocarbon 

contaminants,  as  well  as  the  CO  ,  can  be  eliminated  by  periodic  warm-up  of  the 

2 

system  to  boil  them  off. 

Leakage:  Depending  upon  pressurization  there  can  be  leakage  either 
into  or  out  of  the  cryogenic  system.  Inward  leakage  is  considered  the 
more  hazardous  situation;  therefore  it  is  recommended  that  considera¬ 
tion  be  given  to  a  LOX  system  pressurized  to  maintain  positive  pressure,  even  at 
depth.  The  major  concern  is  that  inward  leakage  leads  to  contamination  either 
by  hydrocarbons  or  sea  water,  the  hazards  of  which  have  been  discussed.  There 
is  particular  concern  for  the  proper  interpretation  of  data  from  status 
monitors.  Examples  have  been  cited  whereby  improper  corrective  action  can 
catastrophically  aggravate  failure  situations.  It  is  strongly  recommended  that 
full-scale  underwater  system  tests  be  conducted  to  evaluate  the  severity  of 
various  system  failures. 
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Overpressure  and  Venting  Since  various  parts  of  the  cryogenic  system  must 
operate  at  vacuum,  others  at  gaseous  oxygen  pressures,  and  still  others  at 
underwater  pressures,  there  exists  a  great  range  of  both  positive  and  negative 
pressures.  Unaer  various  mechanical  failures,  many  of  the  components  must  be 
designed  to  handle  both  extremes.  A  series  of  check  valves,  rupture  disks,  and 
double  valve  disk  arrangements  has  been  discussed.  For  example,  in  the 
situation  calling  for  the  underwater  dumping  of  LOX  it  is  to  be  noted  that  if 
the  rupture  disk  bursts  underwater,  the  entire  system  at  least  up  to  V-14  will 
fill  with  sea  water.  Even  for  controlled  dumping  or  venting  through  CV-0 1,  some 
sort  of  check  valve  to  prevent  sea  water  ingress  will  probably  be  necessary; 
otherwise,  very  close  attention  will  have  to  be  paid  to  pressure  differentials 
between  the  system  and  the  environment.  The  emergency  vapor  vent  almost  cer¬ 
tainly  needs  a  check  valve,  for  without  it,  there  will  be  sea  water  at  full 
pressure  all  the  way  to  V-121,  inside  the  pressure  hull.  Again,  full-scale 
underwater  system  tests  are  recommended  to  simulate  this  and  other  accident 
scenarios. 

Operations:  A  set  of  carefully  adhered  to  operational  standards  must  be 
developed  to  preclude  damaging  the  cryogenic  system,  to  identify  potential 
problems,  and  to  initiate  proper  corrective  action.  Among  the  major 
identifiable  procedures  are  included:  the  slow  filling  with  LOX  to  minimize 
thermal  shocks,  mechanical  stresses,  and  heating  of  gas  bubbles;  constant 
inspection  ot  external  components  for  frost  or  other  signs  of  leakage;  and 
careml  monitoring  of  instruments;  e.g.  computer-based  monitoring,  to  ensure 
unambiguous  interpretation.  It  should  be  repeated  that  improper  corrective 
action,  instigated  by  incomplete  or  improper  readings,  can  aggravate  rather  than 
correct  a  problem.  A  correct  and  complete  data  set,  however,  should  yield  an 
unambiguous  picture  of  the  situation. 

Should  there  be  a  loss  of  power,  the  major  concerns  are  the  possible  loss 
of  instrumentation  and  loss  of  automatic  operation  of  the  hydraulic  systems. 
Temporary  loss  of  instrumentation  would  be  of  major  concern  only  under  accident 
conditions;  loss  of  hydraulic  control  would  represent  a  dangerous  situation, 
wnich  can  be  obviated  by  manual  hydraulic  capability. 
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Mi  s  c  e  1 1  a nv ;  Basic  instrumentation  is  needed  to  monitor  fundamental  parameters 
such  as  temperature,  pressure,  liquid  level  and  flow  rates.  For  example,  the 
system  as  currently  designed  shows  no  way  to  monitor  flow  through  any  of  the 
vent  lines.  More  sophisticated  measurement  methods  are  needed  to  detect  more 
subtle  properties  such  as  the  presence  of  dangerous  contaminants. 

Interestingly,  potentially  hazardous  contaminants  will  not  generally  ignite 
spontaneously,  particularly  at  low  temperatures;  energy  input  would  likely  be 
required.  Care  is  therefore  required  to  minimize  energy  sources  such  as  sparks 
and  hot  spots. 

A  Failure  Analysis  chart  showing  the  consequences  of  the  failure  of 
critical  valves  in  either  the  "open"  or  "closed  "  positions  is  shown  in  Table  I. 

Because  of  the  many  variables  associated  with  the  LOX  concept  of  providing 
life  support  oxygen  in  submarine  use,  the  general  areas  of  concern  identified  in 
this  and  other  safety  related  studies  must  ultimately  be  addressed  in  a  field 
experiment  that  permits  the  simulation  of  various  accident  scenarios.  The 
experiments  should  be  performed  at  depths  which  simulate  deep  submerged 
conditions,  since  a  most  critical  problem  is  the  intrusion  of  sea  water  into  the 
cryogenic  system. 
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